Lucene search

[email protected]NVD:CVE-2014-1546

HistoryAug 14, 2014 - 11:15 a.m.

CVE-2014-1546

2014-08-1411:15:23

CWE-352

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

52.9%

JSON

The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set.

Affected configurations

Nvd

Node

mozillabugzillaMatch3.0

mozillabugzillaMatch3.0rc1

mozillabugzillaMatch3.0.0

mozillabugzillaMatch3.0.1

mozillabugzillaMatch3.0.2

mozillabugzillaMatch3.0.3

mozillabugzillaMatch3.0.4

mozillabugzillaMatch3.0.5

mozillabugzillaMatch3.0.6

mozillabugzillaMatch3.0.7

mozillabugzillaMatch3.0.8

mozillabugzillaMatch3.0.9

mozillabugzillaMatch3.0.10

mozillabugzillaMatch3.0.11

mozillabugzillaMatch3.1.0

mozillabugzillaMatch3.1.1

mozillabugzillaMatch3.1.2

mozillabugzillaMatch3.1.3

mozillabugzillaMatch3.1.4

mozillabugzillaMatch3.2

mozillabugzillaMatch3.2rc1

mozillabugzillaMatch3.2rc2

mozillabugzillaMatch3.2.1

mozillabugzillaMatch3.2.2

mozillabugzillaMatch3.2.3

mozillabugzillaMatch3.2.4

mozillabugzillaMatch3.2.5

mozillabugzillaMatch3.2.6

mozillabugzillaMatch3.2.7

mozillabugzillaMatch3.2.8

mozillabugzillaMatch3.2.9

mozillabugzillaMatch3.2.10

mozillabugzillaMatch3.3

mozillabugzillaMatch3.3.1

mozillabugzillaMatch3.3.2

mozillabugzillaMatch3.3.3

mozillabugzillaMatch3.3.4

mozillabugzillaMatch3.4

mozillabugzillaMatch3.4rc1

mozillabugzillaMatch3.4.1

mozillabugzillaMatch3.4.2

mozillabugzillaMatch3.4.3

mozillabugzillaMatch3.4.4

mozillabugzillaMatch3.4.5

mozillabugzillaMatch3.4.6

mozillabugzillaMatch3.4.7

mozillabugzillaMatch3.4.8

mozillabugzillaMatch3.4.9

mozillabugzillaMatch3.4.10

mozillabugzillaMatch3.4.11

mozillabugzillaMatch3.4.12

mozillabugzillaMatch3.4.13

mozillabugzillaMatch3.5

mozillabugzillaMatch3.5.1

mozillabugzillaMatch3.5.2

mozillabugzillaMatch3.5.3

mozillabugzillaMatch3.6

mozillabugzillaMatch3.6rc1

mozillabugzillaMatch3.6.0

mozillabugzillaMatch3.6.1

mozillabugzillaMatch3.6.2

mozillabugzillaMatch3.6.3

mozillabugzillaMatch3.6.4

mozillabugzillaMatch3.6.5

mozillabugzillaMatch3.6.6

mozillabugzillaMatch3.6.7

mozillabugzillaMatch3.6.8

mozillabugzillaMatch3.6.9

mozillabugzillaMatch3.6.10

mozillabugzillaMatch3.6.11

mozillabugzillaMatch3.6.12

mozillabugzillaMatch3.6.13

mozillabugzillaMatch3.7

mozillabugzillaMatch3.7.1

mozillabugzillaMatch3.7.2

mozillabugzillaMatch3.7.3

mozillabugzillaMatch4.0

mozillabugzillaMatch4.0rc1

mozillabugzillaMatch4.0rc2

mozillabugzillaMatch4.0.1

mozillabugzillaMatch4.0.2

mozillabugzillaMatch4.0.3

mozillabugzillaMatch4.0.4

mozillabugzillaMatch4.0.5

mozillabugzillaMatch4.0.6

mozillabugzillaMatch4.0.7

mozillabugzillaMatch4.0.8

mozillabugzillaMatch4.0.9

mozillabugzillaMatch4.0.10

mozillabugzillaMatch4.0.11

mozillabugzillaMatch4.0.12

mozillabugzillaMatch4.0.13

mozillabugzillaMatch4.1

mozillabugzillaMatch4.1.1

mozillabugzillaMatch4.1.2

mozillabugzillaMatch4.1.3

mozillabugzillaMatch4.2

mozillabugzillaMatch4.2rc1

mozillabugzillaMatch4.2rc2

mozillabugzillaMatch4.2.1

mozillabugzillaMatch4.2.2

mozillabugzillaMatch4.2.3

mozillabugzillaMatch4.2.4

mozillabugzillaMatch4.2.5

mozillabugzillaMatch4.2.6

mozillabugzillaMatch4.2.7

mozillabugzillaMatch4.2.8

mozillabugzillaMatch4.2.9

mozillabugzillaMatch4.3

mozillabugzillaMatch4.3.1

mozillabugzillaMatch4.3.2

mozillabugzillaMatch4.3.3

mozillabugzillaMatch4.4-

mozillabugzillaMatch4.4rc1

mozillabugzillaMatch4.4rc2

mozillabugzillaMatch4.4.1

mozillabugzillaMatch4.4.2

mozillabugzillaMatch4.4.3

mozillabugzillaMatch4.4.4

mozillabugzillaMatch4.5

mozillabugzillaMatch4.5.1

mozillabugzillaMatch4.5.2

mozillabugzillaMatch4.5.3

mozillabugzillaMatch4.5.4

References

advisories.mageia.org/MGASA-2014-0349.html

lists.fedoraproject.org/pipermail/package-announce/2014-August/136217.html

lists.fedoraproject.org/pipermail/package-announce/2014-August/136369.html

www.mandriva.com/security/advisories?name=MDVSA-2014:169

www.securityfocus.com/archive/1/532895

www.securitytracker.com/id/1030648

bugzilla.mozilla.org/show_bug.cgi?id=1036213

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

52.9%

JSON

Related for NVD:CVE-2014-1546

fedora5 nessus5 cvelist1 cve1 mageia1 openvas4 freebsd1 ubuntucve1 securityvulns2 prion1